As part of my learning curve I devised what I thought was a cunning bit of shellery to keep an eye on the impact that my customers are having on one of my VPSs.

Code:
grep -Eo "rejected RCPT <.*@.*>" /var/log/exim_mainlog | awk '{print $3}' | grep -Eo "@[^>]*" | sort | uniq -c | awk '{printf "%04d %s\n",$1,$2}' | sort
Firstly, if anyone sees a more elegant way to arriving at the same sort of output as this, please let me know.

Secondly... It would appear some of my customers are generating over 1100 rejected messages a day.

I have no point of reference to decide if this is excessive... the VPS is only averaging .3 load factor (accounting for processors), so is not over stretched yet, but I want to make sure I get value for money from this box without it being hogged by one of two troublesome domains.